In 2023, a product liability case in California included chat transcripts where a support agent told a customer "that's a known issue, but it shouldn't cause any problems." The product did cause problems. The transcript was introduced as evidence that the company knew about the defect and downplayed it.

The agent was following the standard script. They didn't know the conversation would end up in a courtroom. Nobody told them that "known issue" and "shouldn't cause problems" are phrases that lawyers love to find in discovery.

Every message your support team sends is a potential legal document. Most companies don't treat it that way until it's too late.

How Support Data Enters the Legal System

Discovery is the legal process where parties in a lawsuit exchange relevant documents and records. In the digital age, this includes emails, chat logs, internal notes, ticket histories, and CRM records.

If your company gets sued (by a customer, a competitor, a regulatory body, or in a class action), the other side's lawyers will request all communications related to the issue. Support transcripts are communications. They're discoverable.

A legal hold (also called a litigation hold) requires you to preserve all potentially relevant data from the moment litigation is reasonably anticipated. That means you can't delete tickets, purge chat logs, or clean up internal notes after you get a demand letter. Doing so is spoliation of evidence and can result in sanctions, adverse inferences (the court assumes the deleted data was bad for you), or worse.

What Agents Should Know

Your agents aren't lawyers. They shouldn't write every message as if it's being drafted for a courtroom. But they should know a few things.

"Off the record" doesn't exist in support. There is no informal channel in a customer-facing help desk. Internal notes, Slack messages, even ticket tags can be discovered. If an agent writes "this customer is being ridiculous" in an internal note, that note can end up in front of a jury.

Admissions matter. "Yes, we know about that bug" is an admission that the company had knowledge. "That's a known issue we're working on" is slightly better (it shows remediation). "I'll need to investigate that" is safest when you're not sure.

Promises matter. "I guarantee your data is safe" is a contractual commitment if the data turns out not to be safe. "We take security seriously and follow industry best practices" is safer (though still testable).

Speculation kills. "I think this might be caused by our server migration" is speculation that attributes a customer's problem to your actions. If the agent doesn't know the cause, they should say "I'm investigating the cause" rather than guessing.

The Internal Notes Problem

Most help desks have an internal notes feature (visible to agents, invisible to customers). These notes feel private. They're not.

In discovery, internal notes are just as discoverable as customer-facing messages. "Customer is a nightmare" in an internal note becomes evidence of dismissive attitudes toward complaints. "I'm just going to close this and hope they go away" becomes evidence of negligent support practices.

Train agents to write internal notes as if they might be read aloud in a courtroom. Because they might. Keep notes factual: "Customer reports recurring billing error. Third contact about this issue. Escalated to billing team." Not editorial: "This person complains about everything."

Data Retention and Legal Hold

Your data retention policy determines how long support transcripts exist. If you delete tickets after 90 days, a lawsuit filed on day 91 finds no evidence, which is fine unless you knew litigation was coming. If you were warned (demand letter, regulatory inquiry, customer threatening legal action) and then deleted the data, that's spoliation.

A reasonable retention policy: keep support transcripts for 2 to 5 years, depending on your industry. Healthcare, finance, and other regulated industries may have longer mandatory retention periods.

When litigation is anticipated (you receive a legal threat, a demand letter, or a regulatory notice), immediately issue a legal hold. Notify IT and support leadership: "preserve all data related to [customer/issue/product]. Do not delete, modify, or overwrite." This must happen before anyone cleans anything up.

How AI Changes This

AI-generated responses create a new category of discoverable content. If your AI tells a customer something incorrect ("your data is encrypted at rest with AES-256" when it's actually not encrypted), that response is attributable to your company even though a human didn't write it.

This is one of the strongest arguments for classification-based AI (like Supp) over generative AI for support. A classifier routes to pre-verified responses. A generative chatbot creates novel responses that might contain inaccurate claims. Pre-verified responses can be reviewed by legal. Generated responses cannot, because they're created in real time.

If you use generative AI in support, every AI response should be logged and auditable, with the ability to trace which model version, which prompt, and which training data produced it. When a generated response becomes evidence, you need to explain how it was created.

Practical Steps

Have your support team lead work with legal to create a brief (one-page) guide for agents. Cover: what not to speculate about, how to handle threats of legal action, when to escalate to legal, and how to write internal notes.

Review your internal notes quarterly. Not to police agents, but to identify patterns that create risk. If agents routinely write dismissive notes about customer complaints, that's a training issue and a legal exposure.

Set up data retention policies that balance cost (storing data isn't free) with legal protection (retaining data for reasonable periods). Document the policy so you can demonstrate it existed before any litigation.

When a customer mentions a lawyer, legal action, or regulatory complaint, immediately tag the ticket for legal review. Don't respond with anything substantive until legal has seen it. A response like "I've escalated your concern to our team and someone will follow up within 24 hours" buys time without making admissions.

Supp classifies messages that mention legal threats, lawyers, or lawsuits as high-priority intents. These get routed to a designated escalation path (usually support lead + legal) instead of a frontline agent. The classification happens in under 200 milliseconds, so no agent accidentally responds to a legal threat with a template.